Skip to content

Issue #SBCOSS-548: Vulnerability fixes#200

Merged
pallakartheekreddy merged 1 commit intoSunbird-Lern:release-8.0.0from
chethann007:latest-vuln-fix
Aug 21, 2025
Merged

Issue #SBCOSS-548: Vulnerability fixes#200
pallakartheekreddy merged 1 commit intoSunbird-Lern:release-8.0.0from
chethann007:latest-vuln-fix

Conversation

@chethann007
Copy link
Copy Markdown
Contributor

@chethann007 chethann007 commented Aug 20, 2025

Summary

This PR applies security vulnerability fixes by updating dependencies to patched versions and aligning libraries across modules to ensure compliance, stability, and compatibility.

Description by Korbit AI

What change is being made?

Exclude the vulnerable netty-codec-http dependency from spark-core_2.11 and add a direct dependency to a secure version 4.1.44.Final in pom.xml.

Why are these changes being made?

These changes address security vulnerabilities found in the older version of netty-codec-http which was indirectly included through spark-core_2.11. Updating to a more secure and stable version helps in safeguarding the application against known security threats.

Is this description stale? Ask me to generate a new description by commenting /korbit-generate-pr-description

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR addresses security vulnerabilities by updating the netty-codec-http dependency to a patched version (4.1.44.Final). The changes exclude the vulnerable version from an existing dependency and explicitly declare the secure version to ensure proper dependency resolution.

  • Excludes vulnerable netty-codec-http dependency from an existing transitive dependency
  • Adds explicit dependency declaration for netty-codec-http version 4.1.44.Final

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

@pallakartheekreddy pallakartheekreddy merged commit 952df5d into Sunbird-Lern:release-8.0.0 Aug 21, 2025
1 of 2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants